CLAIMS 



1 . A method for identifying network traffic, comprising: 

converting traffic data into a wave vector; 
comparing the wave vector with a wave template; 
5 determining whether the wave vector is substantially similar to the wave 

template. 

2. A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises performing a transformation on 
the traffic data. 

10 3. A method for identifying network traffic as recited in Claim 1, wherein 

converting the traffic data into a wave vector comprises performing a transformation on 
the traffic data and zero-padding the traffic data. 

4. A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises mapping the traffic data to a 

1 5 plurality of values. 

5. A method for identifying network traffic as recited in Claim 1, wherein 
converting the traffic data into a wave vector comprises mapping the traffic data to a 
plurality of American Standard Code for Information Interchange (ASCII) codes. 

6. A method for identifying network traffic as recited in Claim 1, wherein 

20 comparing the wave vector with a wave template comprises determining a difference 
between the wave vector and the wave template and computing a score based on the 
difference. 

7. A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template 

25 comprises performing a Fourier Transform. 

8. A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template 
comprises determining whether the comparison meets a predetermined criteria. 
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9. A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the wave vector is substantially similar to the wave template 
comprises determining a score based on the comparison. 

10. A method for identifying network traffic as recited in Claim 1, wherein 

5 determining whether the wave vector is substantially similar to the wave template 
comprises determining a score based on the comparison and determining whether the 
score meets a threshold. 

11. A method for identifying network traffic as recited in Claim 1 , wherein the wave 
template is a first wave template and the method further comprises determining whether 

10 the wave vector is substantially similar to a second wave template. 

12. A method for identifying network traffic as recited in Claim 1, wherein the wave 
template is a first wave template and the method further comprises: 

computing a first score based on the comparison of the wave vector with 
the first wave template; 
1 5 comparing the wave vector with a second wave template; 

computing a second score based on the comparison of the wave vector 
with the second wave template; and 

comparing the first score and the second score. 

13. A method for identifying network traffic as recited in Claim 1, wherein the traffic 
20 data includes information extracted from a data packet. 

14. A method for identifying network traffic as recited in Claim 1, wherein the traffic 
data includes information extracted from a plurality of data packets. 

15. A method for identifying network traffic as recited in Claim 1, in the event that 
the wave vector is substantially similar to the wave template, further comprising 

25 determining a property associated with the traffic data. 

16. A method for identifying network traffic as recited in Claim 1, in the event that 
the wave vector is substantially similar to the wave template, further comprising 
determining a property associated with the traffic data and returning an identifier 
indicating the property. 
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17. A method for identifying network traffic as recited in Claim 1, in the event that 
the wave vector is substantially similar to the wave template, further comprising 
determining a property associated with the traffic data; wherein the property is a protocol 

18. A method for identifying network traffic as recited in Claim 1, in the event that 
the wave vector is substantially similar to the wave template, further comprising 
assigning a score to a match. 

19. A method for identifying network traffic as recited in Claim 1, wherein the wave 
template is created by: 

collecting sample traffic; 

transforming the sample traffic to a sample wave vector; and 
performing a computation on the sample wave vector. 

20. A method for creating a wave template as recited in Claim 1, wherein the wave 
template is created by: 

collecting sample traffic; 

transforming the sample traffic to a sample wave vector; 
performing a computation on the sample wave vector; and 
adapting to determine a template length. 

21. A system for identifying network traffic, comprising: 

a processor configured to convert traffic data into a wave vector; compare 
the wave vector with a wave template; and determine whether the wave vector is 
substantially similar to the wave template; and 

a memory coupled with the processor, wherein the memory is configured 
to provide the processor with instructions. 

22. A computer program product for identifying network traffic, the computer 
program product being embodied in a computer readable medium and comprising 
computer instructions for: 

converting traffic data into a wave vector; 
comparing the wave vector with a wave template; 
determining whether the wave vector is substantially similar to the wave 
template. 
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